Credential Vault Options for Data Sources

During guided worker node setup, you will be asked to choose the associated credential store and supply key details like region, keys, URLs, etc. For more information on this step in worker node creation, see Guided Worker Node Installation Overview.

Field

Description

AWS Region

Enter the name of region associated with the data cluster centers.

Example: us-east-1

Access Key

Enter the access key associated with the AWS user account.

Example: AKIAIOSFODNN7EXAMPLE

Secret Access Key

Enter the secret access key associated with the AWS user account.

Example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Optional: Deploy with Native Authentication

Enable the Deploy with Native Authentication to delegate permissions using IAM role(s) in order to make API requests that fetch credentials. The secretsmanager:GetSecretValue permission has to be attached to the role in order to fetch the secrets.

Field

Description

AWS Region

Enter the name of region associated with the data cluster centers.

Example: us-east-1

1. If you have AWS EKS with Nodegroup Infrastructure, the getSecretValue permission must be attached as a policy to the Node IAM role found at Elastic Kubernetes Service > Cluster > Compute.

2. AWS Fargate deployment currently does not support the Native Authentication feature.

Field

Description

Azure Key Vault URL

Enter the URL to the vault. Typically appended with .vault.azure.net

Example: https://workspace123.vault.azure.net

Azure Key Vault Tenant ID

Enter the directory ID associated with the application.

Azure Key Vault Client ID (masked)

Enter the application (client) ID associated with the application.

Example: 627e991e-43cd-61d5-992e-12db9c81b413

Azure Key Vault Client Secret (masked)

Enter the key vault client secret.

Field

Description

Appliance URL (Required)

Enter the URL of the Conjur appliance to which you are connecting.

Account (Required)

Enter the organization account assigned during the Conjur appliance installation.

Login (Required)

Enter the fully-qualified ID of a Conjur host for the service broker.

API Key (Required)

Enter the API Key of the Conjur host whose identity you provided in the Login field.

Account Type

Enter the account type. Variable is selected by default.

Field

Description

Google Credentials

Enter the JSON credentials created in the GCP account to authenticate and authorize calls.

Standard Format

projects/{projectId}/secrets/{secretId}/versions/{versionId}

Example

projects/<data-discovery-306320-Project id>/secrets/<Secretname -S3>/versions/latest

If selected, OneTrust will install the HashiCorp Vault locally in order to store credential details of the data source(s). For configuration guidance, see HashiCorp Key Vault Configuration.

Field

Description

HashiCorp Vault URL

Enter the URL to the external vault.

HashiCorp Vault Token (masked)

Enter the token to the external vault. This is used to connect to the vault.

HashiCorp Vault Key (masked)

Enter the master key to the external vault. This is used to unseal the vault.

Token Auth

Field

Description

HashiCorp Vault URL

Enter the URL to the enterprise vault.

HashiCorp Vault Namespace

Enter the namespace for the enterprise vault.

HashiCorp Vault Authentication

Select the Token authentication method to gain access to the vault.

HashiCorp Vault Token (masked)

Enter the vault token to the enterprise vault.

AppRole Authentication

Field

Description

HashiCorp Vault URL

Enter the URL to the enterprise vault.

HashiCorp Vault Namespace

Enter the namespace for the enterprise vault.

HashiCorp Vault Authentication

Select the AppRole authentication method to gain access to the vault.

HashiCorp Vault Role

Enter the Vault role. The AppRole authentication method allows machines or apps to authenticate with Vault-defined roles.

HashiCorp Vault Role ID

Enter the Role ID of the AppRole.

HashiCorp Vault Secret ID

Enter the Secret ID issued against the AppRole.

HashiCorp Vault Role Path

Enter the vault role path.

Note:

For more information on the policy configuration for AppRole authentication, see the HashiCorp Enterprise AppRole Policy section in HashiCorp Key Vault Configuration.